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, We report on the implementation of a reverse-reconciUated coherent-state continuous-variable 

(N 

'nJ" \ quantum key distribution system, with which we generated secret keys at a rate of more than 2 

\o 

■ kb/s over 25 km of optical fiber. Time multiplexing is used to transmit both the signal and phase 
. reference in the same optical fiber. Our system includes all experimental aspects required for a field 

implementation of a quantum key distribution setup. Real-time reverse reconciliation is achieved 

■ by using fast and efficient LDPC error correcting codes. 
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I. INTRODUCTION 



Quantum Key Distribution (QKD) enables two remote parties, Alice and Bob, linked by a 
quantum channel and an authenticated classical channel, to share a common random binary 
key that is unknown to a potential eavesdropper. Eve. Many QKD protocols [ij] encode 
key information in discrete variables of single photon light pulses, such as polarization or 
phase QflflflBflBB. Recently, other protocols using so-called continuous variables 
(CV), such as both quadratures of a coherent state, have been proposed [10|, lUl, ll2|, Il3|, 
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15|. Channel symbols are formed by conjugate continuous quantum variables, linked by 



Heisenberg inequalities. The secrecy of the QKD protocol is based on the resulting quantum 
uncertainty relations. Such protocols eliminate the need for single photon technology, as they 
only require standard off-the-shelf telecom components — such as diode lasers, electro-optics 
modulators, and PIN photodiodes — compatible with high repetition rates. On the other 
hand, CVQKD protocols require elaborate classical error correction algorithms to efficiently 
extract secret bits from correlated continuous variables. 

In this paper, we describe a complete implementation of the coherent-state reverse- 
reconciliated (RR) CVQKD protocol described in [l^. In this protocol, the quadratures 
X and p of a train of coherent-state pulses are modulated in the complex plane with a cen- 
tered bi-variate Gaussian modulation of variance VaNq, where Nq is the shot noise variance 
that appears in the Heisenberg relation AxAp > Nq. These coherent states are sent from 
Alice to Bob through the quantum channel, along with a strong phase reference — or local 
oscillator (LO). Upon reception. Bob randomly measures the x or p quadrature by making 
the signal interfere with the LO in a pulsed, shot-noise limited homodyne detector. This 
protocol allows Alice and Bob to share a set of correlated Gaussian data. A random fraction 
of this set is publicly revealed to probe the transmission parameters, while the remaining 
part is used to build a secret key based on Bob's data. This is achieved in practice with 
a classical error correction scheme called "Multi-Level Coding" using efficient one-way Low 
Density Parity Check (LDPC) codes. We report the full implementation of both quantum 
and classical parts of this RRCVQKD protocol over a standard single-mode telecom fiber of 
25 km, leading to a final secret key distribution rate of more than 2 kb/s. 
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II. THEORETICAL EVALUATION OF THE SECRET KEY RATES 



In this Section, we detail the calculation of the secret key rates that are available to Alice 
and Bob when applying the RRCVQKD protocol. In QKD, one evaluates the secret key 
rate by upper bounding the information that the adversary, Eve, can acquire in the worst 
case. This is typically done under the following assumptions: (i) Eve has no limit in terms 
of computational power; (ii) Eve has full control over the quantum channel, and is only 
limited in her action on this channel by the laws of quantum physics; (iii) Eve can freely 
monitor the classical public channel used for key distillation, but she cannot modify the 
messages (authenticated channel); (iv) Eve has no access to the laboratories (apparatuses) 
of Alice and Bob. Traditionally, the type of attacks that Eve can implement are ranked by 
increasing power into three classes, depending on how exactly she interacts with the pulses 
sent by Alice with auxiliary pulses (ancillae), and on when she measures these ancillae. The 
theoretical bound on Eve's information depends on the class of attacks that is considered: 

• Individual attack: Eve interacts individually with each pulse sent by Alice, and stores 
her ancilla in a quantum memory. She then performs an appropriate measurement 
on her ancilla after the sifting procedure (during which Bob reveals whether he chose 
to measure x or p), but before the key distillation stage (in particular, before error 
correction). Using this attack, the maximum information accessible to Eve is bounded 

nn 

by the classical (Shannon [16|, 1121) mutual information Ibe on Bob's data. Moreover, 
in the case of continuous-variable QKD, it is known that the optimal individual attack 
is a Gaussian operation [isl, which considerably restricts the set of attacks that need 
to be considered and yields a simple closed formula for Ibe- 

• Collective attack: Eve interacts individually with each pulse sent by Alice but, instead 
of measuring immediately after sifting, she listens to the communication between Al- 
ice and Bob during the key distillation procedure, and only then applies the optimal 
collective measurement on the ensemble of stored ancillae. In this attack, the maxi- 
mum information she may have access to is limited by the Holevo bound xbe [19]. As 
in the case of individual attacks against continuous- variable QKD, Gaussian attacks 



have been shown to be optimal among all collective attacks 
a simple expression for xbe- 
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2l|, which results in 
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Coherent attack: This is the most powerful attack that Eve can implement. Here, 
she is allowed to interact collectively with all the pulses sent by Alice, and, after 
having monitored the key distillation messages, she applies an optimal joint measure- 
ment over all the ancillae. The security with respect to this kind of attacks is more 
complicated to address, but, under the assumption of the symmetry of the privacy 



amplification and channel probing protocols, it was proven 
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"or discrete-variable QKD 



22l | (and conjectured for continuous- variable QKD in [20|, l2l|]) that coherent attacks 
are not more efficient than collective attacks. This step is quite important as it ensures 
unconditional security as long as one has a security proof with respect to collective 
attacks, for which the key rates are far simpler to evaluate. 

In the following, we will consider individual and collective attacks, for which the security 
analysis lies on firm grounds. We will then derive expressions for I be and xbe as a function 
of the losses and of the noise of the quantum channel, assuming as usual that Eve can take 
both of them to her advantage. We will restrict our study to Gaussian attacks, which have 



been shown to be optimal |20|, l2l|] ; this significantly simplifies the calculation of the secret 
key rates since we only have to consider covariance matrices. It is known that Alice and Bob 
can distill perfectly correlated secret key bits provided that the amount of information they 
share, Iab, remains higher than the information acquired by Eve {Ibe or xbe for reverse 
reconciliation). In this strictly information-theoretic point of view, and in the case of RR, we 
define the "raw" key rate as AJ^^^"'^"'^ = Iab - Ibe, or respectively AJHoWo ^ _ 



A. Entanglement-based CVQKD scheme 

An usual prepare-and-measure (P&M) implementation of a Gaussian protocol with coher- 
ent states has been described in Section [H and consists in a quantum transmission followed 
by a classical data processing. During the quantum part, Alice randomly generates two num- 
bers {xa,Pa) from a Gaussian distribution, prepares a coherent state centered on {xa,Pa), 
and sends it to Bob through the quantum channel. Bob receives this state, and randomly 
measures the quadrature x or p by choosing the appropriate phase for his homodyne mea- 
surement. 

As defined in Fig. [H the quantum channel is characterized by its transmission T < 1 
and its excess noise e such that the noise variance at Bob's input is (1 + Te)NQ. We call 
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Channel input Bob's input 




FIG. 1: (Color online) Entanglement-based scheme of CVQKD. The transmittance Ta and r] 
characterize the measurements at Alice's and Bob's sides, while the channel transmittance T and 
added noise xune are controlled by Eve. The QM box corresponds to Eve's quantum memory. 

Xiine = 1/T— l + e the total channel added noise referred to the channel input, which is 
composed of the noise due to losses 1/T — 1 and the excess noise e. With these notations, 
all noises are expressed in shot noise units. The signal then reaches Bob's detector, which 
is modeled by assuming that the signal is further attenuated by a factor r] (detection losses) 
and mixed with some thermal noise (electronic noise v^i added by the detection electronics, 
expressed in shot noise units). The total noise introduced by the realistic homodyne detector 
is Xhom = (1 + '^^ci)/''? — 1, when referred to Bob's input. The total noise added between Alice 
and Bob then reads Xtot = Xune + Xhom/T", referred to the channel input. 



In the following, we will exploit the fact that this P&M description of QKD with Gaus- 
sian states is equivalent to the entanglement-based (EB) scheme presented in Fig. [H which 
simplifies the theoretical calculation of the key rates and provides a unified description of the 
different existing protocols [23]. The main idea is to view Alice's quantum state preparation 
as resulting from the measurement of one half of a two-mode squeezed vacuum state (EPR 
state). The second half of the EPR state corresponds to the state sent to Bob through 
the quantum channel. The Gaussian state ABq is completely determined by its covariance 
matrix '^abq-, which has the form 



EPR 

!V 



V -1 



1 ■ (J^. 



V ■ 1 



(1) 
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where 1 



1 
1 



and (7.y 



1 
-1 



where V is the variance, in shot noise units, of the thermal state that we observe if we trace 
out A. This thermal state also corresponds exactly to the thermal state observed at the 
output of Alice's station if we implement a P&M protocol, resulting from the ensemble of 
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[l3|,Q, 



Gaussian-modulated coherent states (with some specific Gaussian distribution) 
24l |. In fact, every P&M scheme can be rigorously translated into an EB scheme. First, 
the generated states in a P&M scheme are equivalent to the states on which mode Bq is 
projected after Alice's measurement in an EB scheme. Second, the modulation of the states 
in a P&M scheme corresponds in the EB scheme to the variation of the mean value of the 
state of mode Bq conditioned on Alice's measurement. This implies that the modulation 
in the P&M scheme is directly related to Alice's measurement in the EB scheme via a 
one-to-one correspondence. 

As an example, Alice applying a homodyne detection of xa {Ta = 1) corresponds to 
projecting the mode Bq onto squeezed states that are displaced according to a Gaussian 
distribution of the measured quadrature xa- This is exactly equivalent to the protocol 
proposed in [1^. If she applies instead a heterodyne measurement (Ta = 1/2), she prepares 



coherent states modulated over a bi-dimensional Gaussian distribution of variance VaNq, as 
in [l^, [l^. Let us focus on the equivalence between the EB scheme and the P&M scheme 
in this case. In the P&M scheme, Alice randomly chooses the values xa and pa distributed 
according to a Gaussian distribution centered on zero and of variance VaNq, and sends Bob a 
coherent state (VboIa = 1 in shot noise units) centered on {xa,Pa)- In the EB scheme, Alice 
estimates the quadratures xbq and pbq of the state sent to Bob by multiplying the outcomes 
of her measurements by a factor a = 



'v+i ("with a minus sign for p-quadrature) [23|. 
Her uncertainty on the inferred values of xbq and pbq for a given xa and pa is exactly 
^Bo\A = 1; which corresponds to the uncertainty of a coherent state in the P&M scheme. 
The inferred values of xbq and pbq are distributed according to a Gaussian distribution of 
variance VaNq = {V — 1)Nq, which coincides with Alice's modulation in the P&M scheme. 

Note that the EB scheme allows us, at the same time, to simplify the description of 
the realistic detector at Bob side. As shown in Fig. 1, the inefficiency of Bob's detector 
is modeled by a beam splitter with transmission rj, while the electronic noise of Bob's 
detector is modeled by a thermal state pfq with variance V^Nq entering the other input port 



of the beam sphtter, so that Vjv = 1 + v^Jil — rf). Considering the thermal state pp^ as the 
reduced state obtained from a two- mode squeezed state pPoG of variance VnNq allows us to 
simplify the calculations. 

B. Individual attack — Shannon rate 

The mutual information Iab is calculated directly from the variance VbNq of the 
quadratures measured by Bob, with Vb = rjT{y + Xtot), and the conditional variance 
^s|A = ^7^(1 + Xtot) using Shannon's equation 

In an individual attack, Eve performs her measurements just after Bob reveals the quadrature 
he has measured (sifting) but before the error correction. Her information is thus restricted 
to the Shannon information accessible in her ancilla after measurement, and is bounded 
using the entropic uncertainty relations as proven in [l^. In the RR protocol, the reference 
during the error correction protocol being Bob, Eve's information reads 

T Vb 

Ibe = -log2-^ (3) 
^ vb\e 



where Vb = r]T{V + Xtot) and Vb\e = V 



1 

+ Xho 



T(l/l^ + Xlinc) 

Note that we have considered the so-called "realistic model" suggested in [14"], where Eve 
cannot benefit from the noise added by Bob's apparatus, Xhom- The Shannon "raw" key 



rate, proven secure against Gaussian or non-Gaussian, individual or finite-size attacks jl8| . 
then reads A/^i^^'^'^"" = Iab - Ibe- 

C. Collective attack — Holevo rate 

In this case, the mutual information between Alice and Bob remains the same as in the 
case of individual attacks, namely Eq. O). However, Eve's accessible information is now 
upper bounded by the Holevo quantity 22], 

Xbe = S{pe) - J dxB p{xb) Sip''/), (4) 
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where p{xb) is the probabihty distribution of Bob's measurement outcomes, p^^ is the 
state of Eve's system conditional on Bob's measurement outcome xb, and S{p) is the von 
Neumann entropy of the quantum state p |25|. For an n-mode Gaussian state p, this entropy 
reads 



Sip) = EG 



A,- - 1 



(5) 



where G{x) 



(x + 1) lo£ 



[X 



1) — x\og2X and Aj are the symplectic eigenvalues of the 



covariance matrix 7 characterizing p. The calculation of Eve's information xbe is done 
using the following technique. First, we use the fact that Eve's system E purifies AB, 
so that S{pe) = S{pab)- Second, after Bob's projective measurement resulting in xb, the 
system AEFG (see Fig. 1) is pure, so that S{p^b) = S{p^pq), where S{p^pq) is independent 
of Xb for protocols with Gaussian modulation of Gaussian states. Thus, Eq. (jlj) becomes 



Xbe = S{pab) 



(6) 



and can be calculated from the covariance matrix 'y^B that is inferred from the channel 
probing, the detector efficiency r], and the detector electronic noise v^i. 

The entropy S{pab) is calculated from the symplectic eigenvalues Ai,2 of the covariance 
matrix 



lAB 



lA CTAB 
(^AB IB 

V -1 



(7) 



IT{V^ -I) -a, T{V + Xline) ■ 1 

The symplectic eigenvalues of •jab are given by 

1 



A 



1,2 



A ± - AB 



(8) 



where A = V\l - 2T) + 2T + T\V + xnnef and B = T^{Vxiinc + 1)^- Similarly, the 
entropy S{p'^afg) determined from the symplectic eigenvalues A3^4^5 of the covariance matrix 
characterizing the state p^afq after Bob's projective measurement, namely 



IaFG — lAFG - (^AFG;Bi CaFG;Bi 



(9) 



where X 



1 




and MP stands for the Moore Penrose inverse of a matrix. The matrices 
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o'AFG^Bi in Eq. ([9]) can be read in the decomposition of the matrix 



lAFGBi 



lAFG (^AFG;Bi 
(^AFG;Bi iBi 

which is obtained by rearranging the hnes and columns of the matrix describing the system 
AB^FG (see Fig. 1), 



^ABiFG 

where Y 



lABQlf^J" 



Y 



(10) 



S 



BS 
BFo 



1 



G 



This matrix is obtained by applying onto systems B and Fq a beam splitter transformation 
i^BFo) ^^^^ models the efficiency rj of Bob's detector, where Fq is the thermal state that 
models the electronic noise of the detector v^i. A long but straightforward calculation shows 
that the symplectic eigenvalues A3,4 are given by 



X2 



where C 



and D 



(11) 



V^/B + T{V 



+ Ax 



horn 



T{V + xtot) 
V + y/Bxi. om 



nv+xtot) 

while the last symplectic eigenvalue is simply A5 = 1. 
The Holevo information bound then reads 



Xbe 



G 
G 



'Ag-r 



-G 



'A, 



1 



2 

'A4 - 1~ 



(12) 



and the Holevo "raw" key rate, proven secure against collective attacks, reads AJ 
Iab — Xbe- 



Holevo 



III. IMPLEMENTATION OF CONTINUOUS- VARIABLE QUANTUM KEY DIS- 
TRIBUTION 

A. Experimental setup 

The experimental setup for the CVQKD experiments that we have performed is shown 
in Fig. [2j It is a coherent-state QKD setup, operating at 1550 nm and consisting entirely of 
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FIG. 2: (Color online) Experimental setup for CVQKD. 



standard fiber optics and telecommunication components. Alice uses a laser diode, pulsed 
with a repetition rate of 500 kHz, to generate pulses with a width of 100 ns. Using a 
highly asymmetric fiber-optic coupler, these pulses are split into a strong phase reference, 
the local oscillator (LO), containing typically 10^ photons per pulse, and a weak signal. 
The signal pulses are displaced in the complex plane, with arbitrary amplitude and phase, 
randomly chosen from a two-dimensional Gaussian distribution centered at zero and with 
an adjustable variance V^A^o- The selected amplitude and phase values are set by computer- 
driven electro-optics amplitude and phase modulators placed in the signal path. Finally, 
after part of the signal is removed for synchronization and system characterization purposes 
(see Section UlIBI for details), Alice's desired modulation variance is adjusted with a second 
amplitude modulator and a variable attenuator. 

To avoid any polarization and phase drifts that may occur between the signal and LO 
over long-distance transmissions, and thus an incurred additional noise, both signal and LO 
pulses need to travel in the same optical fiber. Because of the simplicity of the corresponding 
setup, we have opted for time multiplexing, which is implemented by delaying the LO using 
an 80 m fiber in its path and then combining the signal and LO pulses at the output of 
Alice's setup, as shown in Fig. [21 Subsequently, the signal and LO pulses, separated by 
400 ns, are sent to Bob via the quantum channel, which is a standard single-mode optical 
fiber coil. 



10 



Bob passively demultiplexes the signal and LO using a 90/10 fiber-optic coupler, thus 
introducing a 10% loss in the signal. Then, Bob selects the quadrature to be measured by 
adjusting the measurement phase with a computer-driven phase modulator placed in the 
LO path. Another 80 m delay line, placed now in the signal path, results in the signal and 
LO pulses overlapping at the output beamsplitter of the interferometer. To ensure a good 
interference contrast, the path difference between the signal and LO has to be adjusted to 
less than a centimeter. The selected quadrature measurement is then obtained with an all- 
fiber shot-noise limited time-resolved pulsed homodyne detection system. This measurement 
consists in the substraction of the photocurrents of two fast InGaAs photodiodes followed 
by a low noise charge amplifier and a constant gain amplifying stage. 

The choice of the coupling ratios for the multiplexing and demultiplexing couplers of 
the signal and LO in the described setup is the result of a trade-off. First, the intensity 
of the LO at the homodyne detection stage needs to be sufficiently high for the shot noise 
to be significantly higher than the electronic noise of the detector. Typically, more than 
10^ photons per pulse are required for this purpose. Second, signal losses at Bob's site 
need to be minimized because they directly contribute to errors that decrease the mutual 
information between Alice and Bob. The coupling ratios quoted in Fig.[2]reflect this trade-off 
and fulfill the intensity level constraints and the stability requirements of the system. 

B. System automation 

Alice and Bob communicate via a synchronous automatic data processing software, de- 
scribed in detail in A key transmission is composed of independent blocks containing 
50 000 pulses. Among these pulses, 10 000 are used as test pulses which have agreed am- 
plitude and phase values, and serve the dual purpose of synchronizing Alice and Bob and 
determining the relative phase between the signal and the LO. An additional random subset 
of the raw data, typically 5 000 pulses, is used for statistical evaluation of the channel param- 
eters, namely the channel transmission T and the excess noise e, over this subset. In addition, 
the signal level sent by Alice and LO level received by Bob are monitored in real-time on 
an individual pulse basis. Note that monitoring the LO level for each pulse also serves the 
purpose of avoiding potential "side-channel" attacks which might tamper classically with 
the LO intensity. When combined with an appropriate calibration, these measurements 
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allow us to obtain an accurate estimate of the shot noise level at Bob's site, which is used 
as a normalization factor. Prom this calibration, we can then determine the second order 
moments of the data distribution between Alice and Bob: V^A^o, VbNq, and the correlation 
p. These moments yield the channel parameters T and e, and the information rates. It is 
important to point out that T is measured both using test pulses of fixed amplitude and a 
subset of the raw data, and the agreement between the two values is continuously checked. 
Taking into account the fraction of pulses used in each block for synchronization and system 
characterization, the repetition rate effectively used for key distribution is 350 kHz. We note 
that higher repetition rates up to 1 MHz have been implemented. 

Wc have designed a software that both manages the interface between Alice and Bob and 
ensures proper hardware operation, with features aiming towards the complete automation 
of the CVQKD system. A software feedforward loop automatically adjusts every 10 sec- 
onds the bias voltages that need to be applied to the amplitude modulators in Alice's site, 
thus compensating for thermal drifts that occur in the timescale of a few minutes. Further- 
more, Alice's output modulation variance is stabilized and controlled by a software loop to 
prevent natural drifts of the system from modifying the signal to noise ratio (SNR). This 
keeps the SNR within the range compatible with the reconciliation codes. At Bob's site, 
another software drives Bob's phase generator, using binary numbers provided by a quantum 
random number generator (id Quantique). This chosen phase is later compensated by the 
measurement of the relative phase between the signal and LO. The implementation of these 
automated procedures ensures a stable and reliable system operation with minimal human 
intervention. Finally, with the exception of the 50/50 coupler at the input of the homodyne 
detection system, the setups of Alice and Bob consist entirely of polarization-maintaining 
components. This means that polarization control is only required before the homodyne 
detector, and to compensate for polarization drifts in the quantum channel. The use of 
a polarization-maintaining homodyne detector and a software-driven low-loss dynamic po- 
larization controller placed at the input of Bob's setup allows the implementation of the 
required compensation while only inducing reasonable losses to the signal, and leads to fully 
automatic operation of the QKD system. 
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C. Experimental parameters and noise analysis 

In the previous sections we have described a system that produces correlated Gaussian- 
distributed continuous variables at an effective rate of 350 kHz. In order to obtain the raw 
key distribution rate from these correlations, we need to evaluate the losses and noise sources 
that are present in the system and degrade its performance. At Alice's site, several sources 
of loss are present in the signal path, namely modulators (2.5 dB each), polarizers (0.3 dB), 
connectors (0.2 dB) or couplers. These losses do not affect the system performance because 
the signal level is set at Alice's output. However, the losses in the LO path need to be 
controlled so that the intensity level is sufficient for the homodyne detection measurement, 
as we discussed in Section fill A[ The quantum channel is a 25 km single-mode optical fiber, 
which presents a loss of 5.2 dB. At Bob's site, the losses of the components in the signal 
path deteriorate the transmission signal to noise ratio (SNR) and thus the amount of key 
information exchanged between Alice and Bob. Therefore, these losses must be minimized. 
To benefit from the "realistic mode" assumption described in Section [Tll it is important 
to carefully calibrate Bob's setup efficiency rj because overestimating this value could open 
a security loophole in the system. The present overall efficiency, including the homodyne 
detection efficiency, is rj = 0.606. Taking into account the measured value T = 0.302 for the 
channel transmission efficiency, we find that the overall transmission between Alice and Bob 
is 7]T = 0.183. 

In addition to the noise introduced by the channel and homodyne detection losses, an 
excess noise due to technical limitations as well as an electronic noise introduced by the 
homodyne detection system are present in the system. The noises contributing to the ex- 
cess noise e can be independently determined from the experimental data, and lead to an 
excess noise of e = 0.005 shot noise units for a modulation variance V^A^o = 18.5A'o. As 
discussed in Section IIIIBt during key transmission the excess noise is measured by the data 
processing software. This measurement was checked experimentally with the implementa- 
tion of an intercept and resend attack, where we expect an excess noise of two shot noise 
units, corresponding to the "entanglement breaking" bound for the coherent-state CVQKD 
protocol [27]. It is important to point out that, in principle, the excess noise is not caused 
by Eve and could be considered inaccessible to her. However, because the diode phase noise 
and the modulation noises depend on the modulation settings, it is difficult to accurately 
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estimate and calibrate this excess noise. Thus, to avoid compromising the security of our 
implementation we assume that it is in fact generated and controlled by Eve. Finally, the 
homodyne detector electronic noise contributes v^i = 0.041 shot noise units to the total 
noise. 

With the help of the equations given in Section [ITl the noise measurements described 
above lead to the raw secret rates: 

Iab = 365 kb/s, Ibe = 313 kb/s 

^jShannon ^ 53 J^b/s 

Iab = 365 kb/s, xbe = 316 kb/s 

^jHolevo ^ 49 j^^/g 

To obtain a secret key from this information, available in the form of raw Gaussian 
correlated data, we have to efficiently extract a string of secret bits from this data. This is 
the subject of the next section, which focuses on the Shannon rate. A very similar procedure 
can be applied to the Holevo rate. 

IV. RECONCILIATION OF CONTINUOUS GAUSSIAN VARIABLES 

In photon-counting based QKD protocols, data is readily available as binary digits and 
can be easily processed for error correction and privacy amplification using well-known pro- 
tocols such as Cascade [28] or Winnow [29]. The amount of secret key that can be extracted 
from these error- correct ion algorithms depends on the error rate of the noisy key. On the 
other hand, continuous-variable QKD protocols only provide Alice and Bob with sequences 
of correlated Gaussian symbols, from which various noise variances are determined 27|]. In 
particular, the variance of the excess noise is the analog of the error rate in photon-counting 
QKD protocols. From these variances, the mutual informations Iab and Ibe can be deduced, 
and thus the secret key rate. Therefore, for CVQKD protocols high secret key distribution 
rates are attainable, provided that the secret information = j^^ — Ibe available 

from the raw Gaussian data can be efficiently extracted. From a strict information-theoretic 
perspective there exists no fundamental limitations to this extraction process. However, in 
practice, error correction requires more information exchange than predicted by Shannon's 
theory. The raw secret information rate is therefore decreased to the effective secret rate 
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^jShannon _ ^j^^ _ j^^^ where the efficiency /3 < 1 characterizes how close the reconcil- 
iation algorithm operates with respect to the Shannon limit (see Section IIV Ap . Since the 
maximum achievable transmission distance ultimately depends on the value of /3, designing 
efficient reconciliation algorithms is one of the challeriges of CVQKD. The efficiency of the 



first reconciliation algorithms used for CVQKD [30|, l3l| did not reach 80% for significant 
line losses, which limited the maximum transmission distance to less than 20 km. In what 
follows, we ffist briefly review the key principles of a more efficient algorithm presented 
in [3^, and then focus on its practical implementation. 

A. Multilevel reverse reconciliation with Low-Density Parity-Check codes 

Let X denote the random variable representing Alice's Gaussian symbols and Y the 
one representing Bob's symbols. In theory Alice and Bob should be able to extract up 
to I{X;Y) common bits from their correlated sequence. Following the idea of [s^. Bob 
ffist quantizes his data to obtain discrete symbols, represented by the variable Q{Y), and 
assigns a binary label to each of them. The quantization necessarily reduces the amount of 
extractable information I{X, Q{Y)) < I{X; Y); however, the penalty can be made negligible 
by choosing the quantizer Q to maximize the mutual information I{X; Q{Y)). In order to 
allow Alice to recover his bit sequence without errors. Bob should then send redundant 
information, such as the value of parity-check equations. The theoretical number of such 



redundancy bits is H{Q{Y)\X) [33||, however in practice perfect error correction is only 
possible when the number of bits disclosed M^^^ exceeds this limit. The efficiency /3 of a 
practical reconciliation algorithm is then defined as: 

^_ i7(6(y))-M... ^ /(X;6(y)) ^^ 

^" HX-Y) - I{X;Y) ^'^^ 

The principle of our reconciliation scheme is shown in Fig. [31 Once his Gaussian symbols 
{yi} have been quantized into {Q{yi)}, Bob assigns a L-bits binary label {^j{yi)}j=Q i_i to 
each of them, and calculates a set of parity bits (or syndromes) for each individual level j 
of label bits. In our case, the number of levels in the multilevel reconciliation is L = 4. This 
particular encoding incurs no loss of performance, and the ideal number of parity bits to 
disclose at each level can be precisely calculated I32I. The levels corresponding to the less 
significant bits often require almost as many parity bits as there are data bits, and in this case 
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FIG. 3: (Color online) Principle of multilevel reconciliation with LDPC codes. 

Bob can simply disclose the entire level. For the levels corresponding to more significant bits, 
the parity bits are calculated according to the parity-check matrix of Low Density Parity 
Check (LDPC) codes. Finally, a few extra parity bits are obtained by applying an algebraic 
code (such as a BCH code [SJ]) to the whole data sequence. 

Alice retrieves Bob's bit sequence by decoding the bit levels successively, using her Gaus- 
sian symbols {xi} and the syndromes sent by Bob. As illustrated in Fig. [3l the decoding of a 
level also exploits the results obtained at the decoding of the previous levels. The standard 



decoding algorithm of LDPC codes {Sum-Product [35|) may sometimes leave a few errors 
uncorrected, however the parity bits obtained with the algebraic code are usually sufficient 
to correct them. 

In comparison with the algorithm proposed in [so!], which introduced slice reconciliation 
with turbo codes, the good efficiency obtained with this algorithm stems from three key 
features. First, codes applied at each level are state-of-the-art LDPC error correcting codes. 
Then, the reliability associated to the decision (so-called soft decoding) output from these 
codes is used as an a priori for the decoding of other levels, rather than only the bit estimate 
issued by each decoder. Finally, we allow several iterations between the levels. In fact, soft 
decoding enables us to start the decoding of a level j even if the previous level j — 1 has 
not been successfully corrected. A later attempt at decoding level j — 1 might benefit from 
a partial decoding of level j and could terminate successfully. In addition, the exchange 
of information during the whole reconciliation process is unidirectional, which leaves no 
ambiguity on the information intercepted by the eavesdropper. 

It was shown in [s^, that LDPC codes with a block length of 200 000 bits were sufficient 
to achieve efficiencies above 85% over a wide range of SNR. 
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The efficiency (3 characterizes the ultimate performance of a reconcihation algorithm, 
however it only assesses its performance from an information-theoretic standpoint and does 
not account for the associated computational complexity. In practice, the latter is of utter- 
most importance if one hopes to obtain high secret key distribution rates. Before going on to 
the details of the implementation of our algorithm, it is worthwhile discussing the trade-off 
between efficiency and decoding complexity. Increasing the reconciliation efficiency while 
still maintaining an arbitrarily low probability of decoding error would require LDPC codes 
operating closer to the Shannon limit as well as many more iterations in the decoding pro- 
cess. It is clear that the code block length and decoding complexity of this scheme would 
then quickly become prohibitive. However, a better trade-off can be obtained by maintaining 
an arbitrarily low probability of undetected errors. In fact, if the reconciliation algorithm 
detects all decoding failures with high probability but fails to correct errors with probability 
Pfaii, the effective secret information rate becomes /S.i'^^^^^'^^^ = (/5J^^ — I^e) (1 —Pia.ii)- It 
is difficult to obtain an analytical expression of pt^a as a function of /3 due to the iterative 
nature of the decoding process, however we observed via Monte-Carlo simulation that P 
could be increased by a few percents without too much sacrifice on Pf^^. Table [T] shows 
our simulation results obtained for a mutual information I{X;Y) = 1 bit/symbol, a 4-bit 
quantization, length 200 000 LDPC codes, and for a BCH code rate of 0.998 to obtain the 
extra parity bits. No undetected errors appeared during the simulations. 



B. Practical implementation 



As mentioned earlier, the efficiency of the reconciliation strongly depends on how close 
the LDPC codes operate with respect to their ideal limit. High efficiency is therefore only 
achievable with relatively large block length (typically over 100 000 bits) and randomly con- 
structed codes 351], which makes a hardware implementation of the algorithm unrealistic. To 
date, high decoding throughputs on Field Programmable Gated Arrays (FPGAs) have only 



LDPC code rates 


(3 


Pfail 


0/0/0.42/0.94 


86.7% 





0/0/0.44/0.94 


88.7% 


10-4 



TABLE I: Simulation results. 
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been obtained with structured short length codes, which specific structure allowed a certain 
amount of parallelism. In our situation, a software implementation of the algorithm turned 
out to be the only viable solution. Typical software implementations of the Sum-Product 
decoding algorithm are rather slow, however the execution speed can be substantially im- 
proved by perfon„,„g fixed-po.p^operat.ous and approximating computat.onal.y intensive 
functions with table look-ups [36]. These simplifications yield a significant overall speed 
gain with a negligible performance degradation. The convergence speed of the LDPC codes 
can also be accelerated by using a modified version of the standard Sum-Product decoding 
algorithm 37|]. A simple change in the scheduling of the decoding reduces the number of 
iterations by a factor almost two without any penalty in terms of performance. 

In the situation of interest for CVQKD, most of the complexity of the reconciliation 
algorithm comes from the use of two LDPC codes of same block length. The decoding 
complexity depends on many parameters, such as the number of iterations performed during 
the decoding of each code, the number of times each level is decoded, the average number of 
terms involved in parity-check equations, etc. For a desired level of performance, there exists 
no generic method for finding a set of parameters minimizing the complexity because all 
parameters interplay in a complex manner. For instance, choosing "better" codes operating 
closer to the Shannon limit could reduce the number of iterations required in each LDPC 
decoder, but the size of the parity-check equations would generally increase. Likewise, 
increasing the number of iterations within a LDPC decoder may sometimes reduce the 
number of iterations required between different decoders. Hence the choice of the parameters 
described hereafter results from many heuristic optimizations. 



C. Optimal reconciliation parameters 

Although code parameters cannot be deduced from an analytical calculation, the optimal 
modulation variance is the result of a quantitative compromise. The reconciliation efficiency 
only depends on the SNR of the transmission, which, for a given distance, is an increasing 
function of the modulation variance VaNq. However, as shown in Fig. HI the effective secret 
rate A/^J^'^"'^"'^ = /SIab — /_b_b as a function of Va and SNR clearly exhibits an optimal value 
for Va- For the targeted transmission distance of 25 km (T = 0.302) and considering the 
detector efficiency and noise discussed in the previous section, which require a reconcilia- 
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FIG. 4: (Color online) Effective key distribution rate as a function of the SNR, or equivalently, as 
a function of the modulation variance VaNq. We assume a linear dependence of e on Va, and use 
the experimental parameters given in Section IIII[ The curves show the key distribution rate for 
values of /5 ranging from 0.6 to 1.0, and the filled circles show the efficiency we actually achieve for 
different SNR. 

tion efficiency above 80%, we obtained the best performance /complexity trade-off with the 
following parameters: 

• modulation variance VaNq = 18.5A^o iH-^'i'^) = 1-045 bit/symbol), 

• quantization with 16 equally spaced intervals {I{X; Q(Y)) = 1.019 bit/symbol), ide- 
ally requiring 4 codes with rates 0.002/0.013/0.456/0.981, 

• practical codes rates 0/0/0.42/0.95, yielding an efficiency P = 0.898. 

These reconciliation parameters are adjusted as the line parameters (namely the excess 
noise) fluctuate, and yield the following secret key distribution rates: 

^jShannon _ ^ kb/s AI^/''™ = 12.3 kb/s 

Since the LDPC codes are very demanding in computing power, the reconciliation speed is 
directly affected by the processor speed. The use of one core of a dedicated Core 2 Duo Intel 
processor leads to a reconciliation speed of 40 000 Gaussian symbols/s, while using a NVidia 
GTX 7950 graphics processor allows a speed of 63 000 symbols/s, to be compared with the 
current repetition rate of 350 000 symbols/s. Taking into account this speed limitation, the 
flnal (net) secure key distribution rates are: 

Using a Core 2 Duo CPU: 

19 



Va(No) 



5 10 15 20 









—1.00 — 








- 0.98 — 
















-0.96 — 
-0.94 








-0.92 
~''.90^ 











'. y. i:^^ • 

0.5 1 1.5 2 2.5 3 3.5 

SNR 



^jShannon ^ ^ J^j^/g AI^°1^™ = 1.4 kb/s 

Using a GTX 7950 GPU: 
^jshannon ^ 2.7 kb/s AI^°i^™ = 2.2 kb/s 

We note that the reconcihation procedure described above has been optimized for the 
case of the Shannon entropy, and further optimization should be considered to achieve a 
higher Holevo rate. 

V. PRIVACY AMPLIFICATION 

At the end of the reconcihation process, the classical error correction algorithm outputs 
blocks of b = 400 000 bits {i.e the two most significant quantization levels of blocks of 
n = 200 000 continuous variables), and each of them needs to be compressed into a much 
shorter secret key of typically k = 10 000 secret bits, depending on the measured secret 
key distribution rate. In order not to affect the overall classical processing speed, this 
particularly large input size requires us to use fast privacy amplification algorithms. Privacy 



amplification 381] consists in randomly choosing a hash function mapping bit strings of length 
b to bit strings of length k, among a suitable set of these functions called a family. The 
probability of success of these algorithms is characterized by the universality e of the family 
of hash functions, and the security parameter s, i.e. the number of bits that are sacrificed 
dunng the ^pMcation p.oce.. Quanatat.vely, the probabUity that Eve k,tow= one bit of 
the final key is about max(2 e — 1) [39]. For universal families of hash functions, defined 
by e = 1, only the security parameter s is therefore relevant. The size of the resulting secret 
key is then k = nAlf^^''''°'' - s. 

The simplest practical universal family of hash functions is the multiplication by a random 
element of the Galois field GF{2}) with I > b jssl. The number theoretic transform (NTT), 



a FFT-like algorithm in GF{2^) enables us to rapidly perform this multiplication 391]. Still, 
the amplification of 400 000 bits with this algorithm takes about 10 seconds on an average 
desktop computer, which is about as long as the whole reconciliation process, thus signifi- 
cantly decreasing the final secret key rate. 

To avoid this long computation time, we use instead a non-universal family of hash 
functions based on the NTT described in 39|] (section 7.3.3). In this algorithm, we first 
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convert the incoming bit string into a vector of Lp elements of the Galois field GF{p) 
{Lp = 2^^ and p = 33 832 961 are suitable for our input string length). Then we compute the 
inverse NTT of the component-wise product of the generated vector with a random vector 
with no zero element. The hash output is then obtained by converting back the result to a bit 
string, which is then truncated to the desired key length. This hash function evaluation only 
requires a few tens of milliseconds, but its universality isei = l + ^~l + 5- 10~^, allowing 
for security parameters up to only about 10. To overcome this problem, we combine this 
algorithm with the universal (e2 = 1) family of hash functions based on the multiplication 
in GF{2"^). For this, we first non-universally hash our b bits into m = 19 937 bits for which 
we know a Galois field, and then universally hash these resulting bits into A; ~ 10 000 bits. 
Although this second hashing algorithm is much slower, the execution time is still tolerable 
due to the reduced input size. The universality of the total composite hashing is ec = 
2A:-i9 937g^ + 62 40|, and so ec — 1 is small enough to allow virtually any reasonable security 
parameter. On a desktop computer, the total hashing time is 0.27 s per block, of which 0.2 s 
are consumed by the second hashing. 

VI. GENERATION OF A SECRET KEY OVER A 25 KM LONG FIBER 

To finalize our CVQKD system, we designed a software implementing the classical chan- 
nel between Alice and Bob. This software continuously retrieves Gaussian data from the 
software driving the experiment, and performs error correction and privacy amplification. 
It features an authentication backend interface that is currently using the authentication 



algorithms developed by the European Integrated Project SECOQC [41|. With the system 
described in the previous sections, which combines CVQKD hardware and key distillation 
software, we have been able to transmit a binary secret key over a 25 km long fiber coil 
with a final secret key distribution rate of 2 kb/s. This rate takes into account the entire 
key distillation procedure, including the classical channel latency. By evaluating our trans- 
mission parameters for different channel transmissions we obtain the raw and effective key 
distribution rate curves shown in Fig. [51 
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FIG. 5: (Color online) Raw and effective key distribution rates for communication secure against 
individual (Shannon) and collective (Holevo) attacks. The reconciliation efficiency for the effective 
key distribution rates is assumed to be /5 = 0.898. The parameters used in the calculations are 
VaNq = 18.5A^0i £ = 0.005, r] = 0.606, v^i = 0.041, the effective repetition rate is 350 kHz, and the 
fiber loss is assumed to be 0.2 dB/km. 

VII. CONCLUSION 

In conclusion, we have presented the implementation of a complete continuous-variable 
quantum key distribution system, generating secret keys at a rate of more than 2 kb/s 
over 25 km of optical fiber. The system is secure against individual and collective attacks, 
when using Shannon or Holevo information bounds, respectively. A single program drives 
hardware automation, signal modulation and measurement, and performs authentication, 
reverse reconciliation, and privacy amplification. Our QKD setup is therefore fully functional 
and meets all aspects required for a field implementation. 

Currently, the secret key rate is limited by data processing and data acquisition, rather 
than by optical components. Further improvements of the reconciliation algorithms, as well 
as the use of faster components (CPUs and data acquisition cards), should thus lead to a 
direct enhancement of the key rate. 
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